[pull] master from YOURLS:master

.git-blame-ignore-revs

@@ -0,0 +1,5 @@
+# End of line reformating
+3daf6593d89c608a6660a6c0b872eeb2607548ba
+# Convert all tabs to spaces
+a4cb0561f627c918cf304663fd32fd2b192f1565
+

.gitattributes

@@ -4,8 +4,11 @@
 # Generate pretty patches for PHP
 *.php diff=php
 
+# Do not generate diff for vendored files
+includes/vendor/** -diff
+includes/vendor/** linguist-generated
+
 # Exclude certain files or directories when generating an archive
-assets/less/    export-ignore
 /.git*          export-ignore
 /*.md           export-ignore
 tests/          export-ignore

.github/workflows/auto-merge.yml

@@ -11,24 +11,4 @@ permissions:
 jobs:
   dependabot:
     name: Dependabot
-    runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    steps:
-      - name: Dependabot metadata
-        id: dependabot-metadata
-        uses: dependabot/fetch-metadata@v1.1.1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Approve a PR
-        if: steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major'
-        run: gh pr review --approve "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Enable auto-merge for Dependabot PRs
-        run: gh pr merge --auto --rebase "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    uses: YOURLS/.github/.github/workflows/auto-merge.yml@main

.github/workflows/ci.yml

@@ -2,30 +2,30 @@ name: CI
 
 on:
   push:
-  pull_request:
     branches: [ master ]
+  pull_request:
+  workflow_dispatch:
+
+# Cancels all previous workflow runs for the same branch that have not yet completed.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
-    name: PHP
+    name: PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.0']
-        phpunit: ['latest']
+        php: ['8.1', '8.2', '8.3', '8.4', '8.5', '8.6']
         include:
-        - php: '7.2'
-          phpunit: '8.5.13'
-        - php: '7.3'
-          phpunit: '8.5.13'
-        - php: '7.4'
-          phpunit: '8.5.13'
-          coverage: xdebug
-          flags: '--coverage-clover clover.xml'
-#         - php: '8.1'
-#           experimental: true
+          - php: '8.1'
+            coverage: xdebug
+            flags: '--coverage-clover clover.xml'
+
+    continue-on-error: ${{ matrix.php == '8.6' }}
 
     services:
       mysql:
@@ -36,17 +36,19 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: false
           MYSQL_ROOT_PASSWORD: secret
           MYSQL_DATABASE: yourls_tests
-        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+          MARIADB_MYSQL_LOCALHOST_USER: 1
+          MARIADB_MYSQL_LOCALHOST_GRANTS: USAGE
+        options: --health-cmd="healthcheck.sh --su-mysql --connect --innodb_initialized" --health-interval=10s --health-timeout=5s --health-retries=3
 
     steps:
-    - uses: actions/checkout@v2.4.0
+    - uses: actions/checkout@v6
 
     - name: Use PHP ${{ matrix.php }}
-      uses: shivammathur/setup-php@2.16.0
+      uses: shivammathur/setup-php@2.36.0
       with:
         php-version: ${{ matrix.php }}
         extensions: mbstring, curl, zip, dom, simplexml, intl, pdo_mysql
-        tools: phpunit:${{ matrix.phpunit }}
+        tools: phpunit
         coverage: ${{ matrix.coverage }}
 
     # - name: Validate composer.json and composer.lock
@@ -77,11 +79,6 @@ jobs:
         cp tests/data/config/yourls-tests-config-ci.php user/config.php
 
     - name: Test
-      run: phpunit --configuration phpunit.xml.dist ${{ matrix.flags }}
+      run: phpunit --configuration phpunit.xml.dist --display-skipped --display-incomplete --display-deprecations --display-notices --display-warnings --display-errors ${{ matrix.flags }}
       env:
         DB_PORT: ${{ job.services.mysql.ports['3306'] }}
-
-    - name: Upload Scrutinizer coverage
-      uses: sudo-bot/action-scrutinizer@latest
-      with:
-        cli-args: "--format=php-clover clover.xml"

.github/workflows/update-certificates.yml

@@ -0,0 +1,91 @@
+name: Update certificates
+
+on:
+  # Run every Monday at 13:37
+  schedule:
+    - cron: '37 13 * * 1'
+  # And manually
+  workflow_dispatch:
+
+# Cancels all previous workflow runs for the same branch that have not yet completed.
+concurrency:
+  # The concurrency group contains the workflow name and the branch name.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  certificate-check:
+    name: "Check for updated certificate bundle"
+    # Don't run the cron job on forks.
+    if: ${{ github.event_name != 'schedule' || github.repository == 'YOURLS/YOURLS' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Generate token
+        uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - name: Get GitHub App User ID
+        id: get-user-id
+        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+      - name: Get current certificate bundle
+        working-directory: ./includes/vendor/rmccue/requests/certificates
+        run: |
+          curl --remote-name https://curl.se/ca/cacert.pem
+          curl --remote-name https://curl.se/ca/cacert.pem.sha256
+
+      - name: Verify the checksum of the downloaded bundle
+        working-directory: ./includes/vendor/rmccue/requests/certificates
+        run: sha256sum --check cacert.pem.sha256
+
+      - name: "Debug info: Show git status"
+        run: git status -vv --untracked=all
+
+      - name: "Get date"
+        id: get-date
+        run: echo "DATE=$(/bin/date -u "+%F")" >> $GITHUB_OUTPUT
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v8
+        id: pull-request
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"
+          base: master
+          branch: auto-update-cacert
+          delete-branch: true
+          commit-message: "Update certificates"
+          title: "Update certificates"
+          body: |
+            Updated certificates, last verified on ${{ steps.get-date.outputs.DATE }}.
+
+            Source: https://curl.se/docs/caextract.html
+          labels: |
+            dependencies
+
+      - name: Approve a PR
+        if: ${{ steps.pull-request.outputs.pull-request-url && steps.pull-request.outputs.pull-request-operation != 'none' }}
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ steps.pull-request.outputs.pull-request-url }}
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Enable Pull Request Automerge
+        if: ${{ steps.pull-request.outputs.pull-request-url && steps.pull-request.outputs.pull-request-operation != 'none' }}
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{ steps.pull-request.outputs.pull-request-url }}
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/update-geoip.yml

@@ -0,0 +1,92 @@
+name: Update GeoIP DB
+
+on:
+  # Run every Monday at 13:37
+  schedule:
+    - cron: '37 13 * * 1'
+  # Run manually
+  workflow_dispatch:
+
+# Cancels all previous workflow runs for the same branch that have not yet completed.
+concurrency:
+  # The concurrency group contains the workflow name and the branch name.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-geoip:
+    name: "Check for updated GeoIP DB"
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Generate token
+        uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - name: Get GitHub App User ID
+        id: get-user-id
+        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+      - name: Check if newer GeoIP DB
+        env:
+          MAXMIND_API_KEY: ${{ secrets.MAXMIND_API_KEY }}
+        run: |
+          URL="https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key=${MAXMIND_API_KEY}&suffix=tar.gz"
+          REMOTE_MODIFIED=$(curl --silent --head "$URL" | grep "last-modified" | sed 's/last-modified: //')
+          REMOTE_CTIME=$(date -d "$REMOTE_MODIFIED" +%s)
+          LOCAL_MODIFIED=$(curl -fsSL https://api.github.com/repos/YOURLS/YOURLS/commits?path=includes/geo/GeoLite2-Country.mmdb | \
+            jq -r '.[0]["commit"]["author"]["date"]')
+          LOCAL_CTIME=$(date -d "$LOCAL_MODIFIED" +%s)
+          echo "Remote: $REMOTE_CTIME ($(date -d @$REMOTE_CTIME))"
+          echo "Local: $LOCAL_CTIME ($(date -d @$LOCAL_CTIME))"
+          if [ $LOCAL_CTIME -lt $REMOTE_CTIME ] ; then curl -fsSL "$URL" | tar -zvx -C includes/geo/ --strip-components 1 -- ; fi
+
+      - name: "Debug info: Show git status"
+        run: git status -vv --untracked=all
+
+      - name: "Get date"
+        id: get-date
+        run: echo "DATE=$(/bin/date -u "+%F")" >> $GITHUB_OUTPUT
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v8
+        id: pull-request
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"
+          base: master
+          branch: auto-update-geoip
+          commit-message: "Update GeoIP DB"
+          title: "Update GeoIP DB"
+          body: |
+            Updated GeoIP database, last verified on ${{ steps.get-date.outputs.DATE }}.
+
+            Source: https://www.maxmind.com/en/account/login
+          labels: |
+            dependencies
+
+      - name: Approve a PR
+        if: ${{ steps.pull-request.outputs.pull-request-url && steps.pull-request.outputs.pull-request-operation != 'none' }}
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ steps.pull-request.outputs.pull-request-url }}
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Enable Pull Request Automerge
+        if: ${{ steps.pull-request.outputs.pull-request-url && steps.pull-request.outputs.pull-request-operation != 'none' }}
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{ steps.pull-request.outputs.pull-request-url }}
+          GITHUB_TOKEN: ${{ github.token }}